Tips on SSH Client Configuration

OpenSSH client ssh obtains configuration data from sources in the following order:

1.  command-line options,
2.  user's configuration file (~/.ssh/config),
3.  system-wide configuration file (/etc/ssh/ssh_config)

Since each parameter may be defined in different sources, order of parameter definition is important. The ssh manual page (ssh_config) says that:

For each parameter, the first obtained value will be used.

Here are some frequently used parameters:
Each configuration file contains sections separated by host specifications that applies to all matching hosts specified by the Host parameter. The host is the hostname argument given on the command line.

Hostname: Specifies the real host name to log into.

IdentityFile: Specifies a file from which the user's public key authentication identity is read.

Port: Specifies the port number to connect on the remote host (if it is not 22).


User:  Specifies the user to log in as.

Here is an example configuration file (~/.ssh/config) for remote machine robert.some.net:

host bob
        hostname robert.some.net
        identityfile /somepath/.ssh/id_rsa_bob
        port 2222
        user root

With the above configuration file, once we issue:

ssh bob

which is equivalent to

ssh -i /somepath/.ssh/id_rsa_bob  -p 2222 root@robert.some.net

Tips on Some Stat Commands for FreeBSD

FreeBSD provides some handy commands to get various information:  Command netstat shows network status, sockstat lists open sockets, fstat identifies active files, and procstat gets detailed process information. Here are some tips on their usages.

1. Show Internet routing table:

netstat -rn

2. Show all active Internet (IPv4) connections (including servers):
netstat -f inet -a -n
or,
sockstat -4
which gives us more information on command name and process identifier (PID) for each connection.

3. Show all Active TCP connections (including servers):
netstat -f inet -p tcp -a -n
or,
sockstat -4 -P tcp

4. Identify processes using a file or directory:
fstat -v /path/to/the/fileORdirectory

5. Identify all files opened by the specified process:
fstat -v -p PID
or,
procstat -f PID

6. Identify all files opened by the specified user:
fstat -v -u user

7. Get detailed process information on all processes:
procstat -a

8. Get environment variables on the specified process:
procstat -e PID

Access UFS File System under Linux

Unix file system (UFS) is widely used in many Unix systems, for example, FreeBSD, OpenBSD, and HP-UX. There are times that we need to access UFS under Linux systems. The following command allows us to mount UFS2 for read-only (ro) under Linux systems:

mount -t ufs -o ufstype=ufs2,ro /dev/sdXY /mnt/path

Write support for UFS is not compiled into Linux kernels by default. One needs to properly configure and compile kernels for write support.

Using findutils to delete files

Here is a summary from the deleting files page.

The most efficient and secure method to delete any file with name ending in '~' in the directory /path is:

find /path -name \*~ -delete

Using command xargs may allow us to achieve same efficiency but is not as secure:

find /path -name \*~ -print0 | xargs -0 /bin/rm

where '-print0' specifies using ASCII NUL to separate the entries in the file list, and similarly '-0' for command xargs.

If the '-delete' action is not available, we may use action '-execdir' or '-exec':

find /path -name \*~ -execdir /bin/rm {} \+

find /path -name \*~ -exec /bin/rm {} \+

Action '-execdir' is secure but less portable. On the other hand, action '-exec' is most efficient portable but insecure. These two actions can be used for doing things other than deleting files.

Create Multiple User Accounts on Linux Systems

adduser is a system command on FreeBSD that allows root to create new user accounts in interactive or batch modes.

useradd is a system command on Linux systems that enable root to create a new user account; to create multiple user accounts on Linux systems in batch mode, we may use the newusers system command.

Each input line for newusers is in the same format as the standard password file with some exceptions. To use command newusers, we need to specify the password for user or leave it blank as for null password. There are times that we need to create multiple user accounts with random passwords. The following bash script allows us to accomplish this with few more options:

#!/bin/bash
function mkpw()
{
    head /dev/urandom | uuencode -m - | sed -n 2p | cut -c1-10;
}

SAVEFILE=newAccounts
chmod 0400 $SAVEFILE
IFS=':'
while  read USER PASSWORD uUID GID FULLNAME HOMEDIR SHELL
do
    PASSWORD=${PASSWORD:-`mkpw`}
    GID=${GID:-"users"}
    SHELL=${SHELL:-"/bin/bash"}
    echo "Adding user '$USER, $FULLNAME'"
    useradd -m $USER -p `mkpasswd -p $PASSWORD` \
        -c "$FULLNAME" -s $SHELL -g $GID
    echo "$USER:$PASSWORD" >> $SAVEFILE
done

where mkpasswd is the command that encrypts the given password. The input file for this script is in the same format as for command newusers. The output file, named newAccounts, contains all newly created account ids and passwords in plain text; you need to take proper action on it.

FreeBSD upgrade

I just finished upgrading host pdp from FreeBSD 9.0 to 9.1. There are few commands to get job done but lots of effort involved.

Four steps to upgrade from 9.0 to 9.1:

1. to gather information necessary for the upgrade
   freebsd-update -r 9.1-RELEASE upgrade
2. committing the upgrade
   freebsd-update install
3. rebooting the system
   shutdown -r now
4. committing the second phase installation
   freebsd-update install

Most effort was paid to upgrade installed packages/applications. A brute-force rebuild of all installed packages was done with:

portupgrade -af

which takes long hours. With the help from screen, it ran smoothly, thought taking more than 1 day.

screen -- a terminal based window manager

Screen is a window manager that multiplexes a physical terminal between several processes. It allows users to run several interactive shell processes within one physical terminal. A subtle application of screen is that it enables processes running despite a dropped connection.

The command screen creates a single window with a  shell and then gets out of our way so that we can use the shell as we do normally.

Everything we type is sent to the process running in the current window, except for one keystroke that is used to initiate a command to the window manager. By default, each command begins with a control-a (Ctrl-a), and is  followed by one other keystroke. The most important screen commands that we needs are:

• Ctrl-a c -- create a new window and switch to that window
• Ctrl-a w -- show a list of windows
• Ctrl-a n -- switch to the next window
• Ctrl-a p -- switch to the previous window
• Ctrl-a 0 -- switch to window number 0
• Ctrl-a 9 -- switch to window number 9
• Ctrl-a d -- detach screen from this terminal

To detach a screen session and return to your normal terminal, type:

Ctrl-a d

All processes (in the screen session) continue to run when screen is detached from the user's terminal.


To get a list of your current screen sessions, (in your normal terminal) type:

screen -ls


In case there is only one screen session, you may reattach to it by typing:

screen -r


In case there are more screen sessions running, you should specify which session to reattach by typing:

screen -r [[pid.]tty[.host]]

where [[pid.]tty[.host]] is the session information obtained by command screen -ls

portupgrade -- upgrade or install packages

portupgrade is a tool for FreeBSD systems to "upgrade installed packages or install new ones via ports or packages".

A brute-force rebuild of all installed packages can be achieved with the following command:

portupgrade -af

where -a means do with all installed packages, -f force upgrade.

A rebuild of all installed packages may require some attentions when prompts with configure menus, which is quite annoying if default configurations work for you, or for other reasons. Is there a way to do portupgrade in a batch mode?

The answer is yes, the option --batch allows portupgrade to run an upgrading process in a batch mode (equivalent to set BATCH=yes). The following command dose portupgrade and requires no interaction from user:

portupgrade -af --batch

find all file descriptors used by a process

A file descriptor (FD) is an abstract indicator for a file accessing. In Unix-like systems, file descriptors can refer to many different objects besides files, such as pipes, unix domain sockets, and internet sockets.

lsof (list open files) is an open source command to report a list of open files and the processes that opened them. To find all file descriptors used by the process with pid, we may issuing the command:

lsof -p pid

To find all internet sockets used by the process with pid, we may issue:

lsof -i -n -P | grep pid

where, -i specifies listing IP sockets only, -n no translation of hostnames, and -P no translation of port names.


What if lsof is not available on your system?

If your system implements the procfs (proc filesystem, /proc), all file descriptors used by the process with pid can be found in the directory /proc/pid/fd. Therefore, on linux systems, you may issue:

ls -l /proc/pid/fd

to get your job done. However, other approach is needed for FreeBSD systems, since procfs is being gradually phased out on FreeBSD. Both fstat (-- identify active files) and procstat (-- get detailed process information) allow us to achieve our goal. You may issue:

fstat -p pid
or,
procstat -f pid

where, pid is the process id of your interest.